This invention relates generally to network security. More specifically, the invention relates to a system and method for providing trusted communications and preventing intrusions in computer communications networks from occurring.
In the current state of the art, the common approach to communications network security is an attempt to identify occurrences of attacker activity after the attacker is present. This requires infrastructure inspections of every packet flow and a state-full inspection at the packet level. After performing all of this work most of these approaches only provide alert messaging of active breaches, thousands of them. Other approaches in security utilize personal encrypted keys and key authentication. These approaches while providing an attempt at session level control carry additional concerns and limitations associated with Quality of Service (QOS) performance impacts along with the need to add additional information to each packet; thus, by looking at the packet, intruders have a clear picture of how and where to modify new packets. In the present context QOS refers to the overall throughput and performance of a network infrastructure. Most corporate security approaches also include anti-viral, signature verification and Network Address Translation (NAT) implementations. NAT enables a local area network to use one set of Internet Protocol (IP) addresses for internal traffic and a second set of addresses for external traffic. Recent attempts have been made to apply flow-based logic to identify hacker activity. However, like their predecessors, these new approaches still rely on “after intrusion” recognition. While improvements have been made to keep up with today's high-speed line rates, intrusion detection is still just that, detection not prevention.
Network security is of paramount importance to network administrators today. Cyber attacks are becoming more frequent and more publicized. Concerted cyber attacks by terrorist organizations can wreak havoc on the infrastructure that modern societies have come to depend upon. The common methods of attack include network packet sniffing, Internet Protocol (IP) spoofing, password attacks, denial of service attacks and application layer attacks. All of these methods require gaining access to the network and no comprehensive solution exists in the prior art to prevent all forms of network intrusion.
A current effort to provide secure private communications over the Internet is Internet Protocol Security (IPSec). This framework uses encryption technology to provide confidentiality, integrity and authenticity between peer devices in a private communications network. The IPSec protocol is a set of security extensions to the TCP/IP protocol that uses cryptographic techniques to protect the data in a message packet. The main transformation types are authentication header (AH) transformation and encapsulating security payload (ESP) transformation. AH transformation provides for authentication of the sender of data. ESP transformation provides for authentication of the sender and encryption of data. Both types of transformations can be made in either transport or tunnel mode. Transformation in transport mode means that the original packet IP header will be the IP header for the transformed packet. Transformation in tunnel mode means that the packet is appended after a new IP header. Both AH and ESP transformations add an extra header to the message packet, i.e., an AH header or an ESP header. Separate key protocols can be selected including the Internet key Exchange (IKE). Session keys have to be exchanged between communicating peers in order to provide secure communications. Although IPSec does address certain aspects of network security, it is not a panacea for all types of attacks. The use of an AH transformation does not protect the confidentiality of data; the use of an ESP transformation protects the confidentiality of data, but also requires key exchange, the use of additional headers increasing packet overhead, and the encryption of the actual data payload.
There is a need for an improved method and system for providing network security that actually prevents intrusions into the network and provides trusted communications between devices in the network.